Electronic archiving and standardization
Why an electronic archiving standard?
Launched on the initiative of market players, a voluntary standard is a reference framework that provides guidelines, technical or qualitative prescriptions for products, services or practices, in the general interest. It is the fruit of a consensual co-production between the professionals and users involved in its development. Any organization may or may not use it and refer to it; this is why the standard is said to be voluntary.
The
NF Z42-013
was drawn up to enable private and public organizations to refer to tried and tested principles and procedures when designing or operating IT systems for recording, archiving and communicating their digital documents. The standard is the basis for certification, which guarantees users that digital documents can be captured, archived, restored and communicated, ensuring that the archived document retains the same value as the original document throughout the entire retention period.
What is probative archiving? How can this standard give me access?
Only a judge can assess the legal admissibility of a document. Case law shows that the use of the voluntary standard
NF Z42-013
or the NF 461 certification certification constitutes a solid basis for proving the document’s admissibility as evidence, in the event of litigation or legal proceedings. This probative value is assessed by the judge with regard to the integrity, reliability and traceability of the document.
Why has the standard been revised? Are new regulations behind it – eIDAS, RGPD or something else?
All standards are revised regularly, approximately every five years, to take account of changes in the markets for which they provide a framework. In this case, standard
NF Z42-013
standard of 2009 did not take into account certain current issues and best practices (electronically signed documents, RGPD, encryption, third-party identity providers), and the regulatory context has evolved over the last ten years. The new version of the standard is intended to be open, giving greater latitude in the choices made.
Organizations concerned
Who is the NF Z42-013 standard on electronic archiving intended for?
The standard
NF Z42-013
is aimed at :
- Public or private organizations needing to preserve their digital objects for organizational, regulatory, heritage or legal protection purposes.
- Suppliers of electronic archiving services and solutions (third-party archivers, infrastructure, software, consulting, etc.)
Who can use NF Z42-013 and how?
The standard
NF Z42-013
standard is aimed at both organizations operating an electronic archiving system on their own behalf, and third-party archivers acting on behalf of their customers. Applying the standard is a voluntary process, but the user who applies it has every interest in claiming that he is doing so scrupulously, with the help of certification.
Developments and impacts
What does the new NF Z42-013 standard offer?
For electronic archiving, the scope of standard
NF Z42-013
has not changed since the 2009 version, but the requirements and recommendations have been explicitly organized, for greater clarity, into three categories: functional, organizational and infrastructure. The main principles remain valid, but have been updated. The standard also allows greater freedom in the implementation and use of recent technologies, as well as the possibility of relying on third-party components and integrating information systems (IS).
The digitization of paper-based business documents has been taken out of the scope of the standard on electronic archiving, which has been taken up in a specific standard of May 2017 (
NF Z42-026
), which we recommend applying to this subject. For documents on other media, the archive owner is advised to apply best practice rules. The appendix on formats has been withdrawn as it is permanently obsolete.
Is the 2009 version of the standard still valid?
The 2020 version of
NF Z42-013
replaces the 2009 version. Regulatory texts referencing the 2009 version of the standard, such as the Decree of December 4, 2009 specifying the standards for outsourced archiving and management services, will need to be updated to apply the requirements of the new version. Similarly, the NF 461 certification standard is currently being updated.
Does ISO 14641 follow the same trends as French standard Z42-013?
The title of the voluntary international standard ISO 14641 is: “Electronic archiving – Design and operation of a computer system for the integrated preservation of electronic records – Specifications.” The current version dates from June 2018. This is an international standard independent of NF Z42-013, which follows its own standardization process. A revision of this document is not currently envisaged.
Does updating the standard have an impact on the archiving process?
The technical archiving process as described in the 2009 version of the standard
NF Z42-013
is compatible with the 2020 version, which offers additional technical possibilities. There is no impact on existing archive stock. On the other hand, the new edition requires special attention in terms of organization and documentation. Archives made permanent using the process defined in the 2009 version of the standard technically meet the challenges of the 2020 version. However, with a view to harmonizing processes, a rework could be carried out.
Lexicon
What’s the difference between archiving, storage and electronic backup?
For long-term preservation in an electronic archiving system (EAS), you need to implement an archiving solution, backed up by a storage solution and abackup solution.
- The aim of archiving is to ensure the availability, integrity, confidentiality and traceability of archives.
- Storage is one of the components of archiving, making it possible to respond to the problem of availability by means of information carriers whose characteristics are adapted to the objectives of archiving.
- The backup, referred to as a security copy in standard
NF Z42-013
is a process enabling information to be recovered in the event of a problem on the primary storage medium.
What’s the difference between an electronic archiving system (EAS) and a digital safe?
The digital safe component of the NF Z42-020 standard standard ensures the integrity and traceability of digital objects deposited in it. It offers special possibilities in terms of confidentiality, with encryption of the data and documents stored on it. The SAE, on the other hand, offers specific archiving functionalities: perpetuation of formats, document typology, life-cycle management, archiving profiles, and so on. Features not available in an electronic safe component or digital safe service. The choice of tool will therefore depend on the conservation objective in question. For example, when it comes to dematerialized pay slips, employers can use an electronic records management system to archive all their employees’ pay slips, while employees can access their dematerialized pay slips via a digital safe.
Certification
What certification is available for electronic archiving?
NF 461 certification
certifies a given electronic archiving system (EAS), supported by a given organization. This means that an organization can offer several SAEs for NF 461 certification. It guarantees the quality and security of the design of the electronic archiving system in relation to the industrialization characteristics of the production chain defined in the standard
NF Z42-013 STANDARD
and additional technical requirements described in NF 461 certification standards. This does not preclude compliance with the requirements for services associated with EAS functionalities.
When is NF 461 certification useful?
NF 461 certification will be of interest to any player wishing to :
- make the operation of an electronic archiving system more reliable, using a best practice repository;
- define the know-how and resources required to deliver quality services;
- describe the technical and contractual specifics for each archive owner;
- guarantee the quality of the solution and the expected performance of its functions;
- have access to a recognized, impartial and reliable certification system;
- involve management and staff in a dynamic, unifying project.
When is NF461 certification required?
NF 461 certification becomes a necessity:
- for use within a contractual framework in which ownership of the trademark is required;
- to obtain approval for the preservation of current and intermediate public archives on digital media.
How do I know if my company’s electronic archiving system is NF 461 certified?
You can consult the
dedicated page
on the marque-nf.com website at any time to access the directory of NF 461-certified electronic archiving systems (SAE) and their electronic certificates.
Does the revision of the standard entail changes to the period of validity of certification and the frequency of compliance audits?
No, the revision of the standard does not entail any change: NF 461 certificates are valid for three years, with annual audits.
If I’m already NF 461 certified, do I have to go through the certification process again?
Holders of an NF 461 certificate must comply with the new requirements of the standard and the certification reference framework for the certified electronic archiving system. They will have a compliance period of one year, starting on the certificate’s expiry date, during which the next audit will incorporate the new requirements.
What should I do if a change affects my certified electronic archiving system?
In the event of a major modification (change of server center, software, etc.), a “modification file” must be sent to AFNOR Certification in accordance with the NF 461 certification standards.
When will the new version of the NF 461 standard be published?
The new version of the
NF 461 certification standard
was published on February 5, 2021.
When can I submit my SAE for NF 461 version 2009 certification?
You can apply for NF 461 version 2009 certification up to the date of publication of the new certification standards. If the certification contract predates this date, only the initial audit can still be carried out on the basis of the 2009 version.
What’s the difference between certification and accreditation?
- Certification is a process whereby a third party provides written assurance that a product, organization, process, service or skill conforms to requirements specified in a reference document. Issued by AFNOR Certification, the
NF 461
is the only certification guaranteeing that an electronic archiving system complies with all the requirements of standard
NF Z42-013 STANDARD
. - Approval is the agreement given by an authority to the appointment of a company to carry out an activity requiring prior authorization. From January1, 2021, approval for the storage and management of current and intermediate public archives will be issued by the prefect of the applicant’s head office, provided that the applicant holds a valid NF 461 certificate.
How can an electronic archiving system be certified?
NF 461 certification is based on the following audit procedures:
- a tour of all EAS-related sites,
- interviews with the staff involved,
- functional demonstrations,
- a literature review.
Standards ecosystem
When should the NF Z42-013 standard on electronic archiving and the NF Z42-026 standard on faithful digitization be used?
The standard NF Z42-026 standard has been drawn up in response to the increasing digitization of document processes within companies, local authorities and administrations, and to legislative changes. Digitizing paper documents provides better access to their content and, by using compliant systems, increases the security of information storage (integrity, confidentiality, availability and durability). This raises the question of whether to dispense with the need for double preservation (original document and faithful digital copy). The NF Z42-026 standard (with its
NF 544 certification
certification) completes the
NF Z42-013
. It determines the responsibilities of the various players involved in digitization, and defines the measures for implementing accurate digitization and digitization processes. Holders of a
NF 461 certificate
certificate integrating digitization systems can usefully apply for NF 544 certification to enhance the quality of their digitization services and their compliance with the standard.
How does the digital safe component relate to the NF Z42-020 standard?
It is necessary to differentiate between the digital safe component described in standard NF Z42-020 and the digital safe service. The
NF Z42-020 standard
standard provides a framework for the digital safe component (software), the aim of which is to provide integrity, traceability and evidential value to the information systems (IS) or applications into which it is integrated. This July 2012 standard describes functional and administrative requirements. It is the basis of the
NF 203 certification standard
(Software Component Digital Safe) certification standard. Since 2016, with the Law for a Digital Republic and even more so since 2018, the digital safe service has had a regulatory framework with decrees 2018-418 and 2018-853.
Do you also need ISO 27001 certification?
Visit
ISO 27001
certification is not a prerequisite for compliance with NF Z42-013. The
NF Z42-013
incorporates several of the principles of ISO 27001. Certification to ISO 27001 in the field of electronic archive management therefore facilitates compliance with NF Z42-013.
